EU AI Act workflow

The end-to-end path a provider or deployer follows, and the API call for each step. Typical setup: your model registry or CMDB drives steps 1–2, your ML pipelines drive 4–5, and CI/CD runs step 6.

Step	AI Act	API
1. Inventory	Art. 26, 49	`POST /systems`
2. Classify	Art. 5, 6, 50, 51; Annex I, III	`POST /systems/{id}/classification`
3. Obligations & controls	Art. 8–17, 26	`GET /systems/{id}/obligations`, `/controls`
4. Evidence	Art. 11, 12, 18	`POST /evidence`, `PATCH /systems/{id}/controls/{code}`
5. Testing	Art. 9, 15	`POST /systems/{id}/redteam-runs`, `POST /findings`
6. Release	Art. 16, 43	`GET /compliance-gate`
7. Monitor & report	Art. 72, 73	`POST /incidents`, webhooks

1. Register the system

Describe the intended purpose precisely: under Art. 3(12) it decides the risk tier. Use roleInValueChain provider if you build or brand it, deployer if you use someone else's.

curl https://v77trust.com/api/v1/systems -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" -d '{
  "name": "CV screening assistant",
  "intendedPurpose": "Rank job applicants for recruiters by fit to the role",
  "roleInValueChain": "deployer",
  "sector": "employment_hr",
  "vendor": "Acme HR AI v4",
  "lifecycleStatus": "pilot"
}'

2. Classify

GET /classification/questions returns the screening questions grouped by section: prohibited practices (Art. 5), high-risk (Annex I products and Annex III use cases), Art. 6(3) derogations, Art. 25 role changes, transparency (Art. 50) and general-purpose AI (Art. 51). Answer yes, no or na; unanswered questions count as no.

curl https://v77trust.com/api/v1/systems/$SYSTEM_ID/classification -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" -d '{
  "answers": { "hr_annex_iii_employment": "yes", "lim_interaction": "yes" }
}'

Classifying a system opens an assessment containing the controls that apply to its tier. Reclassify whenever the intended purpose changes (Art. 25 substantial modification).

Classification is an automated screening against the Act's categories. Have your legal or compliance team confirm the result, especially for Art. 6(3) derogations.

3. Know what to do

curl https://v77trust.com/api/v1/systems/$SYSTEM_ID/obligations -H "Authorization: Bearer $KEY"

4. Attach evidence and close controls

Upload the artefact that proves a control, then mark it implemented. V77 refuses to mark a control implemented without evidence, so your readiness number can be trusted.

curl https://v77trust.com/api/v1/evidence -H "Authorization: Bearer $KEY" \
  -F file=@risk-register-2026Q4.pdf -F title="Risk register Q4" \
  -F systemId=$SYSTEM_ID -F controlCode=V77-RMS-01

curl -X PATCH https://v77trust.com/api/v1/systems/$SYSTEM_ID/controls/V77-RMS-01 -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" -d '{ "status": "implemented", "notes": "Approved by model risk committee" }'

5. Test and log findings

Run the red-team suite, and record issues from your own tests (bias, robustness, pen tests) as findings. Open high or critical findings block the release gate.

curl https://v77trust.com/api/v1/findings -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" -d '{
  "systemId": "'$SYSTEM_ID'",
  "title": "Selection rate for women below 4/5ths of men",
  "severity": "high",
  "frameworkRef": "EU AI Act Art. 10(2)(f)"
}'

6. Gate the release

See Release gate in CI/CD.

7. Monitor and report

Log incidents as they happen to get the regulatory deadlines (incident reporting), and subscribe to webhooks to keep your GRC tool in sync. For auditors, export GET /audit-log and prove its integrity with GET /audit-log/verify.